MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc
SHA3-384 hash:	032e90cdc8e25e841f40cdae39eb355c3ae72693436545cb594236c573d01481d2654e55db312eb73a00d9b17e3b0d86
SHA1 hash:	2eb48e2c31477f855e2547be2cc72a6f38fc5a77
MD5 hash:	33968a4995ae5a1915673235f346970b
humanhash:	oranges-cat-march-bravo
File name:	Tejan Project DOC_SGHTML PDF.JS
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	3'146'767 bytes
First seen:	2026-08-31 14:06:54 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	98304:okbzXOsPvsbdVWXlpXeQgvoiB0khLBmehBUtGqypC1:HeHdVW58fXSMjpC1
TLSH	T117E51B4096825E31A1ACB39CC93779D0C7DD9BA30085DF0D3A68B9103B6E987A35F9F5
Magika	javascript
Reporter	abuse_ch
Tags:	js xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

145

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug downloader dropper evasive obfuscated obfuscated packed repaired xloader

Link:

https://www.filescan.io/uploads/6a958a99ec133b47f28dd28a/reports/c6bb22d4-ac95-4d33-9f38-216f6cfc0f3c/overview

Hybrid Analysis JS/TrojanDropper.ModiLoader

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.ModiLoader

Link:

https://www.hybrid-analysis.com/sample/df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-08-31T08:11:00Z UTC

Last seen:

2026-08-31T10:53:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc/results?tab=lookup

Joe Sandbox XWorm

Result

Threat name:

XWorm

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1966228

Signature

Found direct / indirect Syscall (likely to bypass EDR)

JavaScript source code contains call to eval() to check own source code (likely for evading instrumentation)

JavaScript source code contains functionality to generate code involving a shell, file or stream

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=357s2p6lemkorbgvqlutykqyc5v75r4ug35erql347illpst6l6a._file

Threatray DonutLoader XWorm

Verdict:

malicious

Label(s):

DonutLoader

Alert

Create hunting rule

XWorm

Alert

Create hunting rule

Link:

https://reports.threatray.com/ece0ea87-ba3e-4dd2-b585-c6fb312e66fc

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:xworm collection execution loader rat spyware stealer trojan

Link:

https://tria.ge/reports/260831-re5qesgh46/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Accesses Microsoft Outlook profiles

Checks computer location settings

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Detect Xworm Payload

Detects DonutLoader

Family: DonutLoader

Family: Xworm

Malware Config

C2 Extraction:

102.220.160.87:7009

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.55

Link:

https://yomi.yoroi.company/submissions/df7f2d3fcb2314e884d582e93c2a18176bfec79436fa48c17be7d0b5be53f2fc